Passwords alone are less secure than password + an other authentication methode like TOTP by email.

I think the best is to let the user decide witch level of security they want.